Google Cuts Ties with Entrust Over Compliance Failures and Security Concerns

Google Cuts Ties with Entrust Over Compliance Failures and Security Concerns
Image credit: Google keywords 

Google is ending its relationship with Entrust due to a prolonged period of compliance failures and lack of general improvements. According to a report, Entrust is one of the certificate authorities (CAs) that Chrome uses to verify the trustworthiness of websites. Starting November 1, in Chrome 127, which recently entered beta, TLS server authentication certificates validating to Entrust or AffirmTrust roots will no longer be trusted by default.

Google cited a series of incident reports over recent years regarding Entrust, noting that they "highlighted a pattern of concerning behaviors" that have diminished the company's reputation in Google's eyes. These incidents have "eroded confidence in [Entrust's] competence, reliability, and integrity as a publicly trusted CA owner," Google said in a blog post.

This decision follows a May report by Mozilla that detailed numerous certificate issues with Entrust between March and May of this year. After an initial PR mishap, Entrust acknowledged its procedural shortcomings and stated it was using the feedback as a learning opportunity.

Image credit: Entrust website